Connect with us

Hi, what are you looking for?


Data Breaches

Ransomware Gang Publishes Data Allegedly Stolen From Maritime Firm Royal Dirkzwager

The Play ransomware gang has published data stolen from Dutch maritime services company Royal Dirkzwager.

The Play ransomware gang has released data allegedly stolen from Dutch maritime logistics services company Royal Dirkzwager.

Founded in 1872, the company provides ship management services to hundreds of organizations in the maritime industry, including monitoring of incoming and outgoing vessel traffic in ports, emergency response services, and more.

Royal Dirkzwager fell victim to the cyberattack on March 6, being forced to take systems offline and suspend several services.

While restoration operations started immediately, the company needed roughly a week before being able to clean and fully restore its systems and resume the first services.

At the beginning of last week, Royal Dirkzwager confirmed that it fell victim to a ransomware attack, without providing specific details on the matter.

On March 16, the company announced that almost all services were fully functional, and that it was addressing the last issues.

On the same day, however, the Play ransomware gang published on its Tor leak site a 5 Gb archive containing data allegedly stolen from the maritime services company.

Advertisement. Scroll to continue reading.

The archive, the ransomware operators say, includes both private and personal data, contracts, employee IDs, passports, and more, but they claim it represents only a portion of the data that was exfiltrated from Royal Dirkzwager’s systems.

The cybercriminals also threaten to publish the full batch of data if Royal Dirkzwager does not respond to their demands.

Also referred to as PlayCrypt, the Play ransomware was first spotted in June 2022, but has become one of the most active ransomware families recently.

In February 2023, the Play gang made seven victims, but has already claimed 13 attacks since the beginning of March, data from deep web intelligence project DarkFeed shows. In January, the criminal enterprise was the fifth most active ransomware group.

SecurityWeek has emailed Royal Dirkzwager for additional information on the attack, but has received no response.

Related: Play Ransomware Group Claims Attack on A10 Networks

Related: Play Ransomware Group Used New Exploitation Method in Rackspace Attack

Related: US Government Warns Organizations of LockBit 3.0 Ransomware Attacks

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Data Breaches

LastPass DevOp engineer's home computer hacked and implanted with keylogging malware as part of a sustained cyberattack that exfiltrated corporate data from the cloud...

Data Breaches

GoTo said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.

Data Breaches

A group of hackers has leaked Atlassian employee records and floorplans, information that was obtained from third-party workplace platform Envoy.

Management & Strategy

Industry professionals comment on the recent disruption of the Hive ransomware operation and its hacking by law enforcement.